CCSP Legal, Risk, and Compliance Practice Question
A multinational company is evaluating a cloud provider for a workload that processes personal data of employees in several countries. The company wants to ensure that cross-border data transfers comply with legal requirements. Which consideration is MOST important when assessing the provider's data transfer mechanisms?
⚠ Common exam trap
A common mix-up: candidates confuse security certifications or performance factors with the legal transfer mechanisms required for cross-border personal data flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Whether the provider can contractually commit to a recognized transfer mechanism, such as standard contractual clauses or an approved certification, for each transfer.
Cross-border data transfers require a recognized legal mechanism, such as standard contractual clauses, an adequacy decision, or an approved certification. The provider must be able to contractually commit to the applicable mechanism for every country where personal data is processed or stored. Technical factors like latency or staff location do not satisfy the legal requirement, and security certifications alone do not authorize a transfer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Whether the provider's employees who may access the data are located in the same country as the data subjects.
Why it's wrong here
The location of support or administrative personnel does not by itself provide a lawful transfer mechanism. Access from another country can constitute a transfer, but the relevant question is whether a recognized legal basis exists for that access. Geographic co-location of staff is not a substitute for a transfer mechanism.
- ✓
Whether the provider can contractually commit to a recognized transfer mechanism, such as standard contractual clauses or an approved certification, for each transfer.
Why this is correct
Cross-border transfers of personal data require a valid legal mechanism. Standard contractual clauses, adequacy decisions, or approved certification mechanisms provide that basis. The provider must be able to commit contractually to the applicable mechanism for each transfer path, and the customer must verify that the mechanism covers all countries where data is processed or stored.
- ✗
Whether the provider offers the lowest latency by storing data in the region closest to each employee.
Why it's wrong here
Latency and proximity are performance considerations, not legal transfer mechanisms. Storing data closer to users may improve speed, but it does not determine whether the transfer is lawful under data protection law. The legal basis for the transfer must be established separately.
- ✗
Whether the provider's data centers are certified to ISO/IEC 27001 in every region where data is stored.
Why it's wrong here
ISO/IEC 27001 certification addresses information security management, not the legal adequacy of cross-border data transfers. A provider could be certified yet still lack a valid transfer mechanism such as standard contractual clauses or an adequacy decision. Certification alone does not satisfy transfer requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.